Technical information
Malicious functions:
Executes code of the following detected threats:
- Tool.SilentInstaller.3.origin
Downloads the following detected threats from the Web:
- Tool.SilentInstaller.3.origin
Network activity:
Connecting to:
- a####.####.com
- bookweb####.####.com
- h####.####.com
- i####.####.com
- t####.####.com
- t####.####.com:8900
- ti####.####.com
HTTP GET requests:
- a####.####.com/api/bookapp/dailyRecommend.m?session_id=####&cid=####&ver...
- bookweb####.####.com/v12/contentExtract.m?udid=####&os=####&osv=####&av=...
- i####.####.com/i/chargebook/14/74/1974/2.jpg
HTTP POST requests:
- a####.####.com/apksupload
- h####.####.com/app.gif
- t####.####.com/up
- t####.####.com:8900/up
- ti####.####.com/kirinsdk/updatequery
Modified file system:
Creates the following files:
- <Package Folder>/.jiagu/libjiagu.so
- <Package Folder>/app_jgls/.log.lock
- <Package Folder>/app_jgls/.log.ls
- <Package Folder>/cache/####/-110238552-1514483061
- <Package Folder>/cache/####/-1191788193-416625747
- <Package Folder>/cache/####/-1937899925-1066915802
- <Package Folder>/cache/####/-379523194691898544
- <Package Folder>/cache/####/-387887181-1066915802
- <Package Folder>/cache/####/-879029857-48840119
- <Package Folder>/cache/####/1456380684-671677095
- <Package Folder>/cache/####/19326808301215390166
- <Package Folder>/cache/####/2221232511161639006
- <Package Folder>/cache/####/902404261780060716
- <Package Folder>/database/pushinfo.db
- <Package Folder>/database/pushinfo.db-journal
- <Package Folder>/databases/easouBook.db
- <Package Folder>/databases/easouBook.db-journal
- <Package Folder>/databases/es.db
- <Package Folder>/databases/es.db-journal
- <Package Folder>/databases/es.db-shm (deleted)
- <Package Folder>/databases/es.db-wal
- <Package Folder>/databases/eventInfo.db
- <Package Folder>/databases/eventInfo.db-journal
- <Package Folder>/databases/local.db
- <Package Folder>/databases/local.db-journal
- <Package Folder>/databases/localEasouBook.db
- <Package Folder>/databases/localEasouBook.db-journal
- <Package Folder>/databases/pushstat_5.5.0.db
- <Package Folder>/databases/pushstat_5.5.0.db-journal
- <Package Folder>/databases/u.dbv5
- <Package Folder>/databases/u.dbv5-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/files/####/.jg.ic
- <Package Folder>/files/####/DVDirectory.cfg
- <Package Folder>/files/####/DVHotMap.cfg
- <Package Folder>/files/####/DVHotcity.cfg
- <Package Folder>/files/####/DVVersion.cfg
- <Package Folder>/files/####/ResPack.rs
- <Package Folder>/files/####/firll.dat
- <Package Folder>/files/####/mapstyle.sty
- <Package Folder>/files/####/offinfo.dat
- <Package Folder>/files/####/satellitestyle.sty
- <Package Folder>/files/####/trafficstyle.sty
- <Package Folder>/files/CMRequire.dat
- <Package Folder>/files/VerDatset.dat
- <Package Folder>/files/__local_ap_info_cache.json
- <Package Folder>/files/__local_last_session.json
- <Package Folder>/files/__local_stat_cache.json
- <Package Folder>/files/__send_data_1496213206854
- <Package Folder>/files/__send_data_1496213250743
- <Package Folder>/files/__send_data_1496213251742
- <Package Folder>/files/__send_data_1496213252564
- <Package Folder>/files/epay.jar
- <Package Folder>/files/libcuid.so
- <Package Folder>/files/user_log_3_aeb0e_1496213208167
- <Package Folder>/files/ver.dat
- <Package Folder>/shared_prefs/<Package>.kirin_strategy_control_pref.xml
- <Package Folder>/shared_prefs/<Package>.push_sync.xml
- <Package Folder>/shared_prefs/<Package>.self_push_sync.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/__Baidu_Stat_SDK_SendRem.xml
- <Package Folder>/shared_prefs/com.baidu.pushservice.BIND_CACHE.xml
- <Package Folder>/shared_prefs/common_prefs.xml
- <Package Folder>/shared_prefs/epay_share.xml
- <Package Folder>/shared_prefs/es_a_f_pref.xml
- <Package Folder>/shared_prefs/pst.xml
- <Package Folder>/shared_prefs/pushclient.xml
- <Package Folder>/shared_prefs/qihoo_jiagu_crash_report.xml
- <SD-Card>/PluginLog/####/CrashLog_20170531064730_2754.log
- <SD-Card>/PluginLog/####/CrashLog_20170531064731_3077.log
- <SD-Card>/PluginLog/####/CrashLog_20170531064732_3123.log
- <SD-Card>/backups/####/.confd
- <SD-Card>/backups/####/.confd-journal
- <SD-Card>/backups/####/.cuid
- <SD-Card>/backups/####/.cuid2
- <SD-Card>/backups/####/.timestamp
- <SD-Card>/baidu/####/ls.db
- <SD-Card>/baidu/####/ls.db-journal
- <SD-Card>/baidu/####/yoh.dat
- <SD-Card>/baidu/####/yol.dat
- <SD-Card>/baidu/####/yom.dat
- <SD-Card>/easou_book/####/19929b7d64c64a69cdb02ae3c5313319.image_cover
- <SD-Card>/easou_book/####/4f39a522426b5235b8e32b34b389a8c6.image_cover
- <SD-Card>/easou_book/####/8b069bb5ff3097a1c1704c6937d07f24.image_cover
- <SD-Card>/easou_book/####/alipay_msp.apk
- <SD-Card>/easou_book/####/bookBackup.db
- <SD-Card>/easou_book/####/bookBackup.db-journal
- <SD-Card>/easou_book/####/e55bfc4741f5f721671601c7a09dbbc4.image_cover
- <SD-Card>/easou_book/####/e70243d1901fa022e19f19027d29e9f5.image_cover
Miscellaneous:
Executes next shell scripts:
- <dexopt>
- cat /sys/class/net/wlan0/address
- chmod /data/data/com.esbook.reader 777&& busybox chmod /data/data/com.esbook.reader 777
- chmod 755 /data/data/com.esbook.reader/.jiagu/libjiagu.so
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
- chmod <Package Folder> 777&& busybox chmod <Package Folder> 777
Uses special library to hide executable bytecode.
